Plague17
Plague17 is a ransomware that runs on Microsoft Windows. The early activity of this crypto ransomware occurred around March July 2014. It came back on mid-August 2019. Originally, it was aimed at Russian-speaking users. Now it is It is aimed at English-speaking users. Payload Transmission Plague17 is distributed by hacking through an insecure RDP configuration, using email spam and malicious attachments, deceptive downloads, botnets, exploits, malicious ads, web injects, fake updates, repackaged and infected installers. Infection Plague17 begins the attack by performing a swift scan, which is meant to locate all the files that this data-locking Trojan is meant to encrypt in the next phase of the attack. When this is done, Plague17 will proceed with its encryption process. Plague17 renames all the locked files following this pattern - '.PLAGUE17-. Plague17 encrypts the following extensions: .$$$, .0-9+, .~ini, .~klt, .1cd, .1cd2, .1cl, .1ey, .1txt, .2, .2cd, .6t0-9, .6tr, .7z, .7zip, .8t0, .8tr, .9tr, .a2u, .a3d, .aad, .abd, .accdb, .adb, .adi, .afd, .ai, .als, .amp, .amr, .ans, .apc, .apk, .apx, .arc, .arch, .arh, .arj, .atc, .atg, .ava, .avhd, .avhdx, .awr, .axx, .bac0-9, .backup, .bak, .bck, .bco, .bcp, .bde, .bdf, .bdf, .bf, .bf3, .bg, .bip, .bkc, .bkf, .bkp, .bks, .blb, .blf, .blk, .bln, .bls, .bls, .bmp, .box, .bpl, .bpn, .btr, .burn, .bz, .bz2, .car, .cbf, .cbm, .cbu, .cdb, .cdr, .cdx, .cer, .cf, .cfl, .cfu, .cia, .cmt, .cnc, .cpr, .cr2, .cripted, .criptfiles, .crypt, .csv, .ctl, .ctlg, .cuc, .cui, .cuix, .custom, .dafile, .data, .db, .db0-9, .dbf, .dbk, .dbs, .dbt, .dbx, .dcf, .dcl, .dcm, .dct, .dcu, .dd, .ddf, .ddt, .dfb, .dff, .dfp, .dgdat, .dic, .diff, .dis, .djvu, .dmp, .doc, .docx, .dot, .dpr, .dproj, .drs, .dsus, .dt, .dtz, .dump, .dwg, .dz, .ect, .edb, .efd, .efm, .eif, .elf, .eml, .enc, .enz, .epf, .eps, .erf, .ert, .esbak, .esl, .eso, .etw, .export, .fbf, .fbk, .fdb, .fdb0-9, .fi, .fil, .fkc, .fld, .flx, .fob, .fpf, .fpt, .frf, .frm, .frp, .frw, .frx, .fxp, .gbk, .gbp, .gd, .gdb, .gdoc, .gfd, .gfo, .gfr, .gho, .ghost, .ghs, .gif, .gopaymeb, .gpd, .granit, .grd, .gsheet, .gsn, .gz, .gzip, .hbi, .hbk, .hdf, .his, .hive, .htm, .html, .ib, .idf, .idx, .ifm, .ifo, .ifs, .ima, .img, .imgc, .imh, .imm, .indd, .info, .ipa, .ips, .irsf, .irsi, .irss, .iso, .isz, .iv2i, .jbc, .jpeg, .jpg, .jrs, .kdc, .keg, .key, .klt, .kmn, .kpm, .kwm, .laccdb, .last, .lay6, .lbl, .ldb, .ldf, .ldif, .ldw, .lg, .lgd, .lgf, .lgp, .lic, .lis, .lky, .lnk, .local, .lock, .lrv, .lsp, .lst, .lvd, .lzh, .m2v, .mac, .mak, .map, .max, .mb, .mbox, .mcx, .md, .md5, .mdb, .mde, .mdf, .mdmp, .mdt, .mdw, .mdx, .meb, .mft, .mig, .mkd, .mnc, .mnr, .mns, .mod, .mov, .msf, .mtl, .mxl, .mxlz, .mxlz, .myd, .myi, .n0-9, .nag, .nbi, .nbk, .nbr, .nc, .nd0-9, .ndf, .ndt, .nef, .new, .nif, .nrg, .nsf, .ntx, .nvram, .obf, .ods, .odt, .ogd, .ok, .okk, .old, .one, .onetoc2, .ora, .ord, .ost, .out, .ovf, .oxps, .p12, .packed, .pak, .pas, .paycrypt@gmail_com, .pbd, .pbf, .pck, .pdf, .pdt, .pf, .pfi, .pfl, .pfm, .pfx, .pgd, .pgp, .php, .pka, .pkg, .pkr, .plan, .plb, .pln, .plo, .pm, .pml, .png, .pnl, .ppd, .ppsx, .ppt, .pptx, .prb, .prg, .prk, .profile, .prv, .ps1, .psd, .psl, .pst, .pwd, .pwm, .px, .py, .q1c, .qib, .qrp, .qst, .rar, .rbf, .rcf, .rdf, .rec, .rep, .repx, .req, .res, .rez, .rgt, .rk6, .rn, .rpb, .rpt, .rst, .rsu, .rtf, .rvs, .sac, .sacx, .save, .saved, .sbin, .sbk, .sbp, .scn, .sct, .scx, .sdb, .sdf, .sdl, .sel, .sem, .sfpe, .sfpz, .sgn, .shd, .shdb, .shdl, .shs, .skr, .sln, .smf, .smfx, .sna, .snp, .sob, .sobx, .spr, .sql, .sqlite, .sqm, .sqx, .srx, .ssd, .ssf, .ssp, .sst, .st0-9, .stm, .stop, .str, .sv2i, .svc, .svp, .tab, .tar, .tbb, .tbc, .tbh, .tbi, .tbk, .tbl, .tbn, .tdb, .tgz, .thm, .tib, .tid, .tmf, .tmp, .tmp0, .tnx, .tpl, .tps, .trc, .trec, .trn, .tst, .twd, .txt, .ua_, .udb, .unf, .upd, .utf, .v2i, .v8i, .vault, .vbe, .vbk, .vbm, .vbx, .vct, .vcx, .vdb, .vdi, .ver, .vhd, .vhdx, .vib, .viprof, .vlx, .vmcx, .vmdk, .vmem, .vmp, .vmpl, .vmrs, .vmsd, .vmsn, .vmss, .vmx, .vmxf, .vpc, .vrd, .vrfs, .vsd, .vsv, .vswp, .vvr, .vvv, .wallet, .war, .wav, .wbcat, .wbverify, .wid, .wim, .wnw, .wrk, .wsb, .xch, .xg0, .xls, .xlsb, .xlsm, .xlsx, .xml, .xsc, .xsd, .xstk, .xtbl, .xxx, .xz, .yg0, .ytbl, .zip, .zrb, .zsp, .zup .БРОНЬ Next, Plague17 drops its ransom note, which goes by the name 'Plague17.txt.' The note is only available in Russian. In the note, the attackers warn the victim not to rename any of the locked files and not to attempt to use a third-party decryption tool because they claim this will cause the user to lose all their data permanently. The authors of Plague17 provide the victim with an email address where they demand to be contacted – 'plague17@riseup.net.' They also state that the user has to include all the text from the ransom note in their email or type the number' 68286653' alternatively. The lock screen and ransom notes of Plague contain the following message in Russian meant to scare users into paying the ransom demands: Внимание! Если Вы читаете это сообщение, значит Ваш компьютер был атакован опаснейшим вирусом. Вся Ваша информация (документы, базы данных, бэкапы и другие файлы) на этом компьютере была зашифрована. Все зашифрованые файлы имеют расширение .PLAGUE17 Ни в коем случае не изменяйте файлы! И не используйте чужие дешифраторы, Вы можете потерять Ваши файлы навсегда. Напишите нам письмо на адрес plague17@riseup.net , чтобы узнать как получить дешифратор. Если мы Вам не ответили в течении 3 часов – повторите пересылку письма. В письмо вставьте текст из файла 'PLAGUE17.txt' или напишите номер – 68286653 В первом письме не прикрепляйте файлы для дешифровки. Все инструкции вы получите в ответном письме. The note roughly translates as the following: Attention! If you read this message, it means that your computer has been attacked by a dangerous virus. All your information (documents, databases, backups, and other files) on this computer has been encrypted. All encrypted files have the extension.PLAGUE17 Never modify the files! And do not use other people's decoders, you can lose your files forever. Email us at plague17@riseup.net to find out how to get the decoder. If we have not answered you within 3 hours, please resend the letter. Insert the text from the file 'PLAGUE17.txt' into the letter or write the number - 68286653 In the first letter, do not attach files for decryption. You will receive all instructions in a reply letter. Category:Ransomware Category:Win32 ransomware Category:Win32 Category:Win32 trojan Category:Microsoft Windows Category:Trojan Category:Virus Category:Win32 virus